WASHINGTON — The U.S. Army’s new tactical information warfare unit conducted its first training exercise specifically dedicated to maturing the formation’s concepts and tactics.
The 915th Cyber Warfare Battalion was officially created by Army Cyber Command in 2019. It consists of 12 expeditionary cyber and electromagnetic (CEMA) teams (ECT) that are solely meant to support brigade combat teams or other tactical formations with cyber, electronic warfare and information operations capabilities.
These “fly away” teams, as some officials call them, would help plan tactical cyber operations for commanders in theater and unilaterally conduct missions in coordination with deployed forces.
Expeditionary CEMA Team 1, or ECT-01 participated in the training event that took place in early October at Muscatatuck Urban Training Center in Indiana. The sprawling facility provides a robust digital training environment equipped with infrastructure that can be manipulated in the cyber realm without damaging actual operational systems used by the military or civilians.
While this unit and its predecessor through the CEMA Support to Corps and Below pilot at Fort Irwin, California, previously augmented brigades during training events at the National Training Center, the ECTs were not the primary training unit. They were there solely to augment the brigade that was training.
“Priority one is the ECT’s training proficiency and having a scenario constructed around them as a training audience.” Lt. Col. Matthew Davis, commander of the 915th, said in a news release. “The second purpose is to develop a training plan for how we are going to train ECTs as we build them. This is our first ECT and there are 11 more to come. So how are we going to train them? We have a draft, a beta, and this is a pilot run of the beta to figure out: Have we established the right task, condition, and standards, training objectives, and is this the right training plan?”
The event at Muscatatuck was the first opportunity for the ECT to serve as the primary training audience working to refine tactics, techniques and procedures, as well as concepts and gunnery tables for future certification exercises.
“We have not ever before performed a collective training validation/assessment or figured out what that needs to look like that we need to put an ECT through before we send them off to support another unit,” Capt. Richard Grue, assistant S3 for the 915th Cyber Warfare Battalion, told C4ISRNET in an Oct. 12 interview.
“This type of event would precede deploying teams to a [combat training center rotation] because the problems that we run into when we go train a CTC is that we are not the training audience — it’s the maneuver unit. This provided the opportunity to focus training specifically on the ECT,” Grue added.
The event was primarily focused on the technical aspects of training for the ECTs such as on-net operations. Grue said there was no physical or technical opposing force.
Despite the cyber moniker, these units must not only be proficient in the technical realm but also be able to maneuver with the units they support. This means being able to keep up in formation and avoid being compromised when marching on a particular objective.
Though ECTs previously did this at Fort Irwin in support of brigades conducting a training rotation, this type of physical-specific training for the ECTs is something that is slated down the road, Grue said.
The ECTs will also have to be fully cognizant of the totality of the information environment, as senior leaders call it. This includes the internet as well as other mediums such as social media and traditional media.
Grue said these teams must not only be capable of conducting tactical cyber operations as a standalone capability, but must conduct operations in and through the entire information environment.
Part of the exercise tested concepts and operations within this environment using a simulated internet.
The teams tied together publicly available information via social media to inform operations in both the physical and virtual environments at Muscatatuck, which included targets' workstations, servers used to push propaganda, and physical recruiting meetings, Amanda Lockwood, solutions architect at IDS International, told C4ISRNET in an Oct. 12 interview.
IDS International provided its Social Media Environment and Internet Replication product for the exercise. It provides a simulated social media and internet environment that includes virtual machines. The virtual machines allow participants and simulated users to send and receive emails as well as surf fake websites that include malicious links that infect the entire network.
Units supporting the ECT could use this open social media environment to conduct surveillance of a potential target. Lockwood explained that in one scenario, forces examined the public social media account and website of a human rights group that was acting as a front for a terrorist group to find addresses and locations of key members.
Machines that could be attacked were also part of the virtual environment, allowing the ECT to perform cyber operations and use the larger environment for information purposes, Grue said.
In another drill, the ECT identified a house with a virtual machine inside as significant to the team’s objective. As part of the robust environment at Muscatatuck, this house was equipped with devices on the Internet of Things, with physical and virtual machines run wirelessly or connected directly to a network. Using publicly available open-source tools, the team was able to target the identified system in the house and gain information to enable more physical operations, Lockwood said.
Teams have previously demonstrated the ability to conduct over-the-air operations, targeting Wi-Fi nodes and gain access to closed-circuit television feeds to allow greater intelligence value for commanders planning urban operations. Due to the sensitivities involved, Grue declined to offer specifics regarding the capabilities and equipment the teams were using.
The teams will eventually be outfitted with tactical cyber equipment including the C4ISR/EW Modular Open Suite of Standards man-packable chassis, as well as Modular Open Radio Frequency Architecture-compatible radio heads. These will allow team members to plug into brigade organic assets to leverage their capabilities.
There are no prototypes for this system planned, according to Mark Adams, the vice president and general manager of wireless solutions for L3Harris Technologies. The system’s contractor told C4ISRNET via email that the company expects to deliver initial units in mid-2021. He also said the firm is regularly engaged with units for feedback.
As the Army will build 11 more ECTs, feedback and lessons learned from this first-of-its-kind event were “priceless,” Maj. Marlene Harshman, 915th senior enlisted leader, said in an Army release.
“The lessons learned from the [field exercise] will build on our current and future capacity. We have to constantly focus on the future and adapt to make expeditionary cyber better, with every operation and every lesson learned,” she said. “[Muscatatuck] provided that dynamic environment for us to learn and grow as a team. That was critical in this first-ever event where the entire ECT was exercised."
Grue noted that Muscatatuck is probably the best area for this type of training. As such, he noted one of his biggest takeaways from the event was that the service needs a very robust team and environment for training to be effective, given all an ECT does.
“There really needs to be a robust exercise support cell in order to create an environment or create a scenario that trains everybody from the fires operators to the electronic warfare practitioners. It’s a very robust team that has to come together to make an event successful and valuable for the ECT,” he said.
Mark Pomerleau is a reporter for C4ISRNET, covering information warfare and cyberspace.
